@sema-agent/core 7.1.0 → 7.3.0

package/dist/core/runner/prepare-task.d.ts

@@ -24,13 +24,14 @@ import { type ToolManifestRow } from "../../prompt-assembly/tool-catalog.js";
 import type { ToolDisclosureManifest } from "../trace.js";
 import { type ClearedProjectionLedger, type ContextEditMachine, type OccurrenceIndex } from "../context-edit.js";
 import type { TaskNotificationPayload } from "../task-notification.js";
+import type { RemoteExecutionEnv, SnapshotId } from "../remote-env.js";
 import { type CwdRef, type ReadFace } from "../../tools/fs/index.js";
 import { type WorkflowSizeGuideline } from "../../orchestration/workflow-size-guideline.js";
 import type { Runner } from "./runtask.js";
 import { type CheckpointGate, type CheckpointState, type CheckpointToken, type ResourceLedger, type PlatformLimitReason, type ResourceLimitReason } from "../checkpoint-store.js";
 import { type WiringManifest } from "../wiring-manifest.js";
 import type { ActiveWorktreeSession, AgentMessage, AgentTool, ExecutionEnv } from "../../internal/harness.js";
-import type { NestedUsageAccum, RunnerDeps, TaskEvent, TaskResult, TaskSpec, ToolActivity, ToolEffect } from "../types.js";
+import type { NestedUsageAccum, RemoteEnvFailureNote, RunnerDeps, TaskEvent, TaskResult, TaskSpec, ToolActivity, ToolEffect } from "../types.js";
 import type { RepairBundle } from "../../agents/repair-loop.js";
 /** Test seam (mirrors `__resetToolModelGateAnnouncements`): never called by production code.
  *  Re-arms BOTH arms (a WeakMap has no clear — it is re-minted). */
@@ -40,6 +41,13 @@ export declare function __resetMaterializeEnvAnnouncements(): void;
  *  seam below (console latch only): tests here legitimately reuse ONE sink across prepares to pin
  *  the per-sink dedup itself, so the seam must be able to re-arm a still-referenced sink. */
 export declare function __resetToolModelGateAnnouncements(): void;
+/**
+ * The model gate's per-session READ face ({@link WiringManifest.modelGate}) — projected from the SAME
+ * gate decision {@link announceToolModelGate} reads (one source; the notice is the operator-sink
+ * dialect, this the manifest dialect). `undefined` when no default-mounted tool was trimmed on this
+ * run. The restore sentence is the notice's, verbatim.
+ */
+export declare const TOOL_MODEL_GATE_RESTORE_SENTENCE = "restore via TaskSpec.restoreGatedTools, SEMA_TOOL_MODEL_GATE=off, or RunnerDeps.toolModelGate: false";
 export { __resetReadFaceClampAnnouncement } from "./prepare-hands-readface.js";
 /**
  * design/164 件四 — how long before an execution environment's declared `lifetimeMs` expires the engine
@@ -1176,6 +1184,19 @@ export interface InheritedGate {
     }>;
     /** The chain's effective shell-gate doctrine — the child folds it by max-rank with its own spec. */
     shellGate?: "off" | "always" | "classify";
+    /**
+     * The chain's AUTO-MODE INTENT (`TaskSpec.autoModeRequested`, session-wide like a permission mode):
+     * emitted when the spawning task carried the intent itself or inherited it, so an engine-spawned
+     * child of an auto-mode task arms its OWN per-run classifier exactly as its parent did — the
+     * intent half only; the child's deny bit (`RuntimeCaps.autoMode === false`) and deployment face
+     * (`RunnerDeps.autoMode`) are evaluated for the child. Trusted chain data (Runner-assembled, never a
+     * model-authored argument); absent ⇒ the child is an auto-mode task only if its own spec says so.
+     * Persists on the checkpoint's data half (`CheckpointState.inheritedGate.autoModeRequested`) so a
+     * redemption in another process — no seat re-passed, no waking chain — reads the same intent the
+     * suspend leg had; the intent folds by OR across seat, live chain and seed, while the deny bit and
+     * the deployment face stay per-leg.
+     */
+    autoModeRequested?: true;
     /**
      * Org-memory admission freeze (ruled 2026-08-05): the spawning chain's FROZEN admitted org-scope
      * set — every org memory scope the parent actually mounted (deployment-origin + admitted request).
@@ -1896,6 +1917,43 @@ export declare function batchContextAt(messages: AgentMessage[], currentId: stri
     batchToolCallIds: string[];
     completedCallIds: string[];
 };
+/**
+ * design/384 slice 2 — the ONE compensation for a paused-but-unparked VM, shared by the fence's
+ * post-pause checkpoints (③ in the park closure, ④ in the saga) and the saga's put-failure absent
+ * arm (previously inline there: same two hops, one implementation now, so the three sites cannot
+ * drift). Restores the workspace (bounded transient retry) then re-establishes consistency
+ * (`postResumeInit`), both hops under one INDEPENDENT `AbortSignal.timeout(io.boundMs)` —
+ * deliberately NOT the run/cut signal: the remote contract answers an already-aborted signal
+ * `{ok:false,"aborted"}`, so gating the restore on the very signal whose firing caused the
+ * compensation made it die instantly and strand the paused VM on exactly the run-abort arm that
+ * needs it most. The adapter signal is best-effort (a deaf adapter ignores it), so the caller's
+ * await is ALSO raced against the same bound — bounded decision, three outcomes:
+ *  · settled ok  ⇒ the VM is running again ({ok:true});
+ *  · settled not-ok / threw ⇒ recorded + disclosed, {ok:false} — the caller takes its fatal
+ *    fail-closed arm (abort the run; never continue on a paused VM);
+ *  · bound fires with the adapter still in flight ⇒ {ok:false} NOW, and the in-flight call
+ *    continues DETACHED + swallow-guarded with the late-settlement split:
+ *     – late SUCCESS: a running VM now exists with no run and no committed row to own it — the
+ *       detached continuation compensates the compensation with `destroy()` (the adapter's own
+ *       best-effort contract, swallow-guarded, disclosed);
+ *     – late FAILURE: disclosed; the VM is most likely still paused — provider-side TTL/GC
+ *       territory, and the disclosure is the end of this engine's obligation (a deaf adapter's
+ *       stranded VM is that adapter's own defect surface).
+ * Decide-then-disclose throughout: `io.disclose`/`io.noteFailure` must be swallow-guarded by the
+ * caller's binding, and nothing they do can change the returned verdict. Never throws. Exported for
+ * direct unit pinning (the bounded/deaf/late arms need a small bound; production binds the
+ * `PARK_COMPENSATION_TIMEOUT_MS` constant at the one call-site closure).
+ */
+export declare function compensateUnparkedPause(remoteEnv: RemoteExecutionEnv, snapshotId: SnapshotId, io: {
+    boundMs: number;
+    noteFailure: (note: RemoteEnvFailureNote) => void;
+    disclose: (err: unknown) => void;
+}): Promise<{
+    ok: true;
+} | {
+    ok: false;
+    reason: string;
+}>;
 /**
  * rescan C5 — the ONE spelling of the placement fields' empty-string discipline: `""` is absence
  * wearing clothes (the resume entry's principal-rung posture), and every placement read that must